What changed in this filing

/stocks — the workspaceLOADING

Item 1A. Risk Factors

2025-03-26 compared with 2024-03-27 · 173 added, 128 removed, 259 unchanged (54% of the section changed)

RISK FACTORS.

An investment in our common stock involves a high degree of risk.

2 unchanged sentences

RISKS RELATED TO OUR BUSINESS

Loss of key resellers could reduce our revenue growth.

We rely on our reseller sales channel, which purchases and resells our end-to-end services to its own portfolio of merchant customers.

This channel is a strong contributor to our revenue growth.

If a reseller switches to another transaction processor, shuts down, becomes insolvent, or enters the processing business themselves, we may no longer receive new merchant referrals from the reseller, and we risk losing existing merchants that were originally enrolled by the reseller, all of which could negatively affect our revenues and earnings.

If our security applications are breached by cyberattacks or are not adequate to address changing market conditions and customer concerns, we may incur significant losses and be unable to sell our services.

20 unchanged sentences

Further, adverse publicity raising concerns about the safety or privacy of electronic transactions, or widely reported breaches of our or another provider's security, have the potential to undermine consumer confidence in the technology and could have a materially adverse effect on our business.

Our efforts to expand our product portfolio and market reach, including through acquisitions, may not succeed and may reduce our revenue growth and we may not achieve or maintain profitability.

Since 2014, we have completed a total of four acquisitions which have allowed us to expand our product offerings.

For example, we acquired the assets of IMS, a business of electronic bill presentment, document composition, document decomposition and printing and mailing services serving hundreds of customers representing a wide range of industry verticals, including utilities and financial institutions on December 15, 2020.

We also continue to invest in our established business lines and new markets, such as our payment facilitation, and prepaid card business.

While we have grown the proportion of revenue from these newer products and services and we intend to continue to broaden the scope of products and services we offer, we may not be successful in maintaining or growing our current revenue streams or deriving any significant new revenue streams from these products and services.

Failure to successfully broaden the scope of products and services that are attractive may inhibit our growth and harm our business.

Furthermore, we expect to continue to expand our markets in the future, and we may have limited or no experience in such newer markets.

We cannot assure you that any of our products or services will be widely accepted in any market or that they will continue to grow in revenue.

Our offerings may present new and difficult technological, operational, regulatory, risks, and other challenges, and if we experience service disruptions, failures, or other issues, our business may be materially and adversely affected.

Our expansion into newer markets may not lead to growth and may require significant management time and attention, and we may not be able to recoup our investments in a timely manner or at all.

If any of this were to occur, it could damage our reputation, limit our growth, and materially and adversely affect our business.

We may need additional financing in the future.

We may be unable to obtain additional financing or if we obtain financing it may not be on terms favorable to us.

You may lose your entire investment.

Based on our current plans, we believe our existing cash and cash equivalents and cash flow from operations will be sufficient to fund our operating expense and capital requirements for at least 12 months, although we may need funds in the future.

At December 31, 2023 we had $7.2 million of cash and cash equivalents, and for the year ended December 31, 2023, operating activities provided $14.9 million.

After adjusting for the impact of operating lease right-of-use assets, operating lease liabilities, prepaid card load obligations and merchant reserves included in the statement of cash flows, net cash provided by adjusted operating activities, was $2.8 million for the year ended December 31, 2023.

Adjusted operating cash flow is viewed by the company as a superior indicator of the Company's operating performance and ability to fund acquisitions, capital expenditures and other investments and, in the absence of refinancing options, to repay debt obligations.

Refer to Item 7, under the subsection "Management's Discussion and Analysis of Financial Condition and Results of Operations - Key Business Metrics - Non-GAAP Financial Measures" for our reconciliation of operating cash flows to adjusted operating cash flows.

If our capital resources are insufficient to meet future capital requirements, we will have to raise additional funds by selling assets, borrowing money from a third party, or by selling debt or equity securities.

If we are unable to obtain additional funds on terms favorable to us, we may be required to cease or reduce our operating activities.

If we must cease or reduce our operating activities, you may lose your entire investment.

Unauthorized disclosure of cardholder data, whether through breach of our computer systems or otherwise, could expose us to liability and protracted and costly litigation.

1 unchanged sentence

As a result, we are required to comply with the privacy provisions of the Gramm-Leach-Bliley Act, various other federal and state privacy statutes and regulations, and the Payment Card Industry Data Security Standard, each of which is subject to change at any time.

Compliance with these requirements is often difficult and costly, and our failure, or our distributors’ failure, to comply may result in significant fines or civil penalties, regulatory enforcement action, liability to our issuing banks and termination of our agreements with one or more of our issuing banks, each of which could have a material adverse effect on our financial position and/or operations.

Compliance with these requirements is often difficult and costly, and our failure, or our resellers' failure, to comply may result in significant fines or civil penalties, regulatory enforcement action, liability to our issuing banks and termination of our agreements with one or more of our issuing banks, each of which could have a material adverse effect on our financial position and/or operations.

In addition, a significant breach could result in our Company being prohibited from processing transactions for any of the relevant card associations or network organizations, including Visa, Mastercard, American Express, Discover or regional debit networks, which would also have a significant material adverse impact on our financial position and/or operations.

11 unchanged sentences

In addition, our cardholders and customers could lose confidence in our ability to protect their information, which could cause them to discontinue using our services.

If we fail to comply with the applicable requirements of the respective card networks, they could seek to fine us, suspend us or terminate our registrations.

In order to provide our transaction processing services, we are registered with Visa, Mastercard and Discover as service providers and transaction processors for member institutions and with other networks.

As such, we are subject to card association and network rules that could subject us to a variety of fines or penalties that may be levied by the card networks for certain acts or omissions.

The rules of the card networks are set by their boards, which may be influenced by banks that own their stock and, in the case of Discover by the card’s issuers, and some of those banks and issuers are our competitors with respect to these processing services.

The termination of our registrations or our status as a service provider or transaction processor, or any changes in card association or other network rules or standards, including interpretation and implementation of the rules or standards, that increase the cost of doing business or limit our ability to provide transaction processing services to our customers, could have a material adverse effect on our business, operating results and financial condition.

If a merchant or one of our resellers fails to comply with the applicable requirements of the card associations and networks, it could be subject to a variety of fines or penalties that may be levied by the card associations or networks.

If we cannot collect such amounts from the applicable merchant or one of our resellers, we could end up bearing such fines or penalties, resulting in lower earnings for us.

Fraud by merchants or others could have an adverse effect on our operating results and financial condition.

We have potential liability for fraudulent bankcard, ACH and prepaid card transactions or credits initiated by merchants or others.

Examples of merchant fraud include when a merchant knowingly uses a stolen or counterfeit bankcard, card number or bank account to record a false sales transaction, processes an invalid bankcard, or intentionally fails to deliver the merchandise or services sold in an otherwise valid transaction.

Criminals are using increasingly sophisticated methods to engage in illegal activities such as counterfeit and fraud.

While we have systems and procedures designed to detect and reduce the impact of fraud, we cannot assure the effectiveness of these measures.

It is possible that incidents of fraud could increase in the future.

Failure to effectively manage risk and prevent fraud would increase our chargebacks liability or cause us to incur other liabilities, including regulatory and association fines, penalties and harm to our reputation.

Increases in chargebacks or other liabilities could have an adverse effect on our operating results and financial condition.

If we do not adapt to rapid technological change, including as a result of artificial intelligence, our business may fail.

2 unchanged sentences

In addition, the software market is subject to rapid and substantial technological change.

To remain successful, we must respond to new developments in hardware and semiconductor technology, operating systems, programming technology and computer capabilities.

To remain successful, we must respond to new developments in hardware and semiconductor technology, operating systems, programming technology computer capabilities and the growing use of artificial intelligence, or AI and machine learning.

Generative AI has become more publicly available and enterprise adoption of generative AI has grown.

We have not incorporated AI features into our products and technologies and our success will depend in part on our ability to do so.

Incorporating generative AI into our products will require a significant investment by us which could have a material adverse effect on our results of operations and financial condition.

In many instances, new and enhanced services, products and technologies are in the emerging stages of development and marketing and are subject to the risks inherent in the development and marketing of new software, services and products.

3 unchanged sentences

If we are unable, for technological or other reasons, to develop and introduce new services and products in a timely manner in response to changing market conditions or customer requirements, our business may fail.

Growing use of artificial intelligence has challenges that, if not properly managed could result in harm to our brand, reputation, business or customers, and adversely affect our results of operations.

The use of AI presents risks.

AI algorithms may be flawed, and datasets may be insufficient.

Inappropriate or controversial data practices by us or others could impair the acceptance of AI solutions or subject us to lawsuits and regulatory investigations.

These deficiencies could undermine the decisions, predictions or analysis AI applications produce, subjecting us to competitive harm, legal liability and brand or reputational harm.

In addition, the use of AI may increase cybersecurity risks, privacy risks, and operational and technological risks.

The technologies underlying AI and their use cases are rapidly developing, and it is not possible to predict all of the legal, operational or technological risks related to the use of AI.

Moreover, how AI is used is the subject of evolving review by various U.S.

regulatory agencies, including the SEC and the FTC.

It is possible that governments may also seek to regulate, limit, or block the use of AI or otherwise impose other restrictions that may hinder the usability or effectiveness of our products and services.

Our efforts to expand our product portfolio and market reach, including through acquisitions, may not succeed and may reduce our revenue growth and we may not achieve or maintain profitability.

Since 2014, we have completed a total of four acquisitions which have allowed us to expand our product offerings.

For example, we acquired substantially all of the assets of IMS, a business of electronic bill presentment, document composition, document decomposition and printing and mailing services serving hundreds of customers representing a wide range of industry verticals, including utilities and financial institutions on December 15, 2020.

We also continue to invest in our established business lines and new markets, such as our payment facilitation, and prepaid card business.

Failure to successfully broaden the scope of products and services that are attractive may inhibit our growth and harm our business.

Furthermore, we expect to continue to expand our markets in the future, and we may have limited or no experience in such newer markets.

We cannot assure you that any of our products or services will be widely accepted in any market or that they will continue to grow in revenue.

Our expansion into newer markets may not lead to growth and may require significant management time and attention, and we may not be able to recoup our investments in a timely manner or at all.

If any of this were to occur, it could damage our reputation, limit our growth, and materially and adversely affect our business.

We may need additional financing in the future.

We may be unable to obtain additional financing or if we obtain financing it may not be on terms favorable to us.

You may lose your entire investment.

At December 31, 2024 we had $8.1 million of cash and cash equivalents, and for the year ended December 31, 2024, operating activities provided $2.9 million.

If we are unable to obtain additional funds on terms favorable to us, we may be required to cease or reduce our operating activities to a level that operations can support.

If we must cease or reduce our operating activities, you may lose your entire investment.

Business interruptions or systems failures may impair the availability of our websites, applications, products or services, or otherwise harm our business.

16 unchanged sentences

In addition, any failure to successfully implement new information systems and technologies, or improvements or upgrades to existing information systems and technologies in a timely manner could have an adverse impact on our business, internal controls (including internal controls over financial reporting), results of operations, and financial condition.

Fraud by merchants or others could have an adverse effect on our operating results and financial condition.

We have potential liability for fraudulent bankcard, ACH and prepaid card transactions or credits initiated by merchants or others.

Criminals are using increasingly sophisticated methods to engage in illegal activities such as counterfeit and fraud.

While we have systems and procedures designed to detect and reduce the impact of fraud, we cannot assure the effectiveness of these measures.

It is possible that incidents of fraud could increase in the future.

Increases in chargebacks or other liabilities could have an adverse effect on our operating results and financial condition.

We rely on our relationship with the Automated Clearing House network, and if the Federal Reserve rules were to change, our business could be adversely affected.

8 unchanged sentences

At this time, we believe we could find and enter into additional agreements with other bank sponsors on similar contractual terms, but no assurances can be made.

Loss of key resellers could reduce our revenue growth.

We rely on our reseller sales channel, which purchases and resells our end-to-end services to its own portfolio of merchant customers.

This channel is a strong contributor to our revenue growth.

If we lose key personnel or we are unable to attract, recruit, retain and develop qualified employees, our business, financial condition and results of operations may be adversely affected.

2 unchanged sentences

Failure to retain or attract key personnel and skill sets could have a material adverse effect on our business, financial condition and results of operations.

Table of Content

If our third-party card processing providers or our bank sponsors fail to comply with the applicable requirements of Visa, Mastercard and Discover credit card associations or if our current processors cancel or fail to renew our contracts, we may have to find a new third-party processing provider, which could increase our costs.

13 unchanged sentences

We may not be able to obtain and maintain sufficient insurance coverage.

We insure against a majority of business risks, including liability for cyber incidents, and for director and officer liability.

We insure against a majority of business risks, including liability for cyber incidents, and for director and officer liability ("D&O").

D&O and cyber insurance especially are becoming increasingly challenging to purchase and maintain due to market factors.

3 unchanged sentences

We have incurred substantial losses in the past and may incur additional losses in the future.

We reported a net loss of $0.5 million and $5.5 million for the years ended December 31, 2023 and December 31, 2022, respectively.

We reported net income of $3.3 million and a net loss of $0.5 million for the years ended December 31, 2024 and December 31, 2023, respectively.

Including these results, we have an accumulated deficit of $68.0 million at December 31, 2024.

5 unchanged sentences

We have recorded significant deferred tax assets, and we might never realize their full value, which would result in a charge against our earnings.

As of December 31, 2023, we had deferred tax assets of $1.5 million.

As of December 31, 2024, we have net deferred tax assets of $4.7 million.

Realization of our deferred tax assets is dependent upon our generating sufficient taxable income in future years to realize the tax benefit from those assets.

2 unchanged sentences

This could be caused by, among other things, deterioration in performance, adverse market conditions, adverse changes in applicable laws or regulations, including changes that restrict the activities of or affect the solutions sold by our business and a variety of other factors.

If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, the charge to earnings would be recognized as an expense in our results of operations in the period the determination is made.

If a deferred tax asset net of our valuation allowance was determined to be not realizable in a future period, a charge to earnings would be recognized as an expense in our results of operations in the period the determination is made.

Additionally, if we are unable to utilize our deferred tax assets, our cash flow available to fund operations could be adversely affected.

8 unchanged sentences

If we are unable to find a replacement financial institution to provide sponsorship or become a member of the association, we may no longer be able to provide prepaid processing services to our Mastercard customers, which would negatively impact our revenues and earnings.

If we fail to comply with the applicable requirements of the respective card networks, they could seek to fine us, suspend us or terminate our registrations.

As such, we are subject to card association and network rules that could subject us to a variety of fines or penalties that may be levied by the card networks for certain acts or omissions.

If we cannot collect such amounts from the applicable merchant or one of our resellers, we could end up bearing such fines or penalties, resulting in lower earnings for us.

If we fail to comply with complex and expanding consumer protection regulations, our business could be adversely affected.

The establishment of the federal Consumer Financial Protection Bureau, or CFPB, will likely expose us to increased regulatory oversight and possibly more burdensome regulation that could have an adverse impact on our revenue and profits.

For example, on October 5, 2016, the CFPB issued a final rule to regulate certain prepaid accounts, or the Prepaid Account Rule.

The Prepaid Account Rule mandates, among other things, extensive pre-purchase and post-purchase disclosures, expanded electronic billing statements, adherence to certain overdraft regulations for prepaid accounts that permit negative balances, and public posting of account agreements and submission to the CFPB which will then publish them on its website.

The Prepaid Account Rule took effect on April 1, 2019, subject to certain exceptions.

On January 25, 2018, the CFPB announced certain changes to the Prepaid Account Rule, including allowing the error resolution and liability limitations protections to apply prospectively, after a consumer’s identity has been verified, and providing more flexibility to credit cards linked to digital wallets.

On February 27, 2019, the CFPB also announced a streamline electronic submission system, or Collect, for prepaid account issuers to submit their prepaid account agreements, including fee information, to the CFPB.

All prepaid account agreements offered as of April 1, 2019 must be uploaded to Collect by May 1, 2019.

Thereafter, prepaid account issuers must make a submission to the CFPB within 30 days after a new agreement is offered, a previously submitted agreement is amended, or a previously submitted agreement is no longer offered.

Compliance with existing and new obligations as result of further expanding consumer protections regulations, could result in increased compliance costs for us, our issuing banks and our distributors, and may therefore have a negative impact on the profitability of our business.

Table of Conte

We are subject to extensive and complex federal and state regulation and new regulations and/or changes to existing regulations could adversely affect our business.

As an agent of, and third-party service provider to, our issuing banks, we are subject to indirect regulation and direct audit and examination by the Office of Thrift Supervision, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, or the FRB, and the Federal Deposit Insurance Corporation.

On March 23, 2010, the FRB issued a final rule implementing Title IV of the Credit Card Accountability, Responsibility, and Disclosure Act of 2009, or CARD Act, which imposes requirements relating to disclosures, fees and expiration dates that are generally applicable to gift certificates, store gift cards and general-use prepaid cards.

We believe that our general-purpose re-loadable prepaid cards, and the maintenance fees charged on our general-purpose re-loadable cards, are exempt from the requirements under this rule, as they fall within an express exclusion for cards which are re-loadable and not marketed or labeled as a gift card or gift certificate.

However, this exclusion is not available if the issuer, the retailer selling the card to a consumer or the program manager, promotes, even if occasionally, the use of the card as a gift card or gift certificate.

As a result, we provide retailers with specific instructions and policies regarding the display and promotion of our general-purpose re-loadable cards.

However, it is possible that despite our instructions and policies to the contrary, a retailer engaged in offering our general-purpose re-loadable cards to consumers could take an action with respect to one or more of the cards that would cause each similar card to be viewed as being marketed or labeled as a gift card, such as by placing our general-purpose re-loadable cards on a display which prominently features the availability of gift cards and does not separate or otherwise distinguish our general purpose re-loadable cards from the gift cards.

In such event, it is possible that such general-purpose re-loadable cards would lose their eligibility for such exclusion to the CARD Act and its requirements, and therefore could be deemed to be in violation of the CARD Act and the rule, which could result in the imposition of fines, the suspension of our ability to offer our general-purpose re-loadable cards, civil liability, criminal liability, and the inability of our issuing banks to apply certain fees to our general-purpose re-loadable cards, each of which would likely have a material adverse impact on our revenues.

In 2014, we resumed issuing gift cards.

Any gift cards we issue will be governed by the CARD act and other various regulations.

Any violations with our gift card issuance could result in the imposition of fines, the suspension of our ability to offer our gift cards, civil liability, criminal liability, and the inability of our issuing banks to apply certain fees to our gift cards, each of which would likely have a material adverse impact on our revenues.

As the laws applicable to our business, and those of our distributors and issuing banks, change frequently, are often unclear and may differ or conflict between jurisdictions, ensuring compliance has become more difficult and costly.

Any failure, or perceived failure, by us, our issuing banks or our distributors to comply with all applicable statutes and regulations could result in fines, penalties, regulatory enforcement actions, civil liability, criminal liability, and/or limitations on our ability to operate our business, each of which could significantly harm our reputation and have a material adverse impact on our business, results of operations and financial condition.

State and federal legislatures and regulatory authorities have become increasingly focused upon the regulation of the financial services industry and continue to adopt new legislation which could result in significant changes in the regulatory landscape for financial institutions, which could include our bank sponsors, and other financial services companies, such as our Company.

If our software fails, and we need to repair or replace it, or we become subject to warranty claims, our costs could increase.

9 unchanged sentences

To the extent we outsource our disaster recovery, we are at risk of the vendor’s unresponsiveness in the event of breakdowns in our systems.

Table of Content

Our card programs are subject to strict regulation under federal law regarding anti-money laundering and anti-terrorist financing.

Failure to comply with such laws, or abuse of our card programs for purposes of money laundering or terrorist financing, could have a material adverse impact on our business.

Provisions of the USA PATRIOT Act, the Bank Secrecy Act and other federal law impose substantial regulation of financial institutions designed to prevent use of financial services for purposes of money laundering or terrorist financing.

Increasing regulatory scrutiny of our industry with respect to money laundering and terrorist financing matters could result in more aggressive enforcement of such laws or more onerous regulation, which could have a material adverse impact on our business.

In addition, abuse of our prepaid card programs for purposes of money laundering or terrorist financing, notwithstanding our efforts to prevent such abuse through our regulatory compliance and risk management programs, could cause reputational risk or other harm that would have a material adverse impact on our business.

Effective September 27, 2011, the Financial Crimes Enforcement Network of the U.S.

Department of the Treasury, or FinCEN, issued a final rule regarding the applicability of the Bank Secrecy Act’s anti-money laundering provisions to prepaid products and other matters related to the regulation of money services businesses.

This rule created additional obligations for entities, including our distributors, engaged in the provision and sale of certain prepaid products, including our prepaid debit cards, such as the obligation for sellers of prepaid debit cards to obtain identification information from the purchaser at the point-of-sale.

Compliance with these obligations may result in increased compliance costs for us, our issuing banks and our distributors, and may therefore have a negative impact on the profitability of our business.

We will be liable for separation payments in case of change in control, termination without cause, non-renewal of the agreement, death, or disability under the employment agreement with our Chairman, President, Chief Executive Officer, and Chief Operating Officer, Mr.

Hoch, which could have an adverse effect on our cash position and on our financial results.

Pursuant to our employment agreement, as amended, with Louis Hoch, Chairman, President, Chief Executive Officer, and Chief Operating Officer, in the event of change in control, termination without cause, termination by employee, or non-renewal of the employment agreement, we will be liable for separation payments, equaling an amount of (a) 2.95 times the respective base salary and bonus payments, plus (b) a pro rata portion of the respective annual bonus based on the number of days elapsed in the year prior, plus (c) 2.0 times the respective base salary for non-competition, and (d) continuing other benefits.

Pursuant to our employment agreement, as amended, with Louis Hoch, Chairman, President, Chief Executive Officer, and Chief Operating Officer, in the event of change in control, termination by the Company without cause, termination by employee for good reason, or non-renewal of the employment agreement, we will be liable for separation payments, equaling an amount of (a) 2.95 times the respective base salary and bonus payments, plus (b) a pro rata portion of the respective annual bonus based on the number of days elapsed in the year prior, plus (c) 2.0 times the respective base salary for non-competition, and (d) continuing other benefits.

We estimate the cash disbursements over time to be $5.9 million for the agreement with Mr.

14 unchanged sentences

In addition, the loss of our Chairman or Chief Executive Officer may adversely affect our business and results of operations.

We are subject to the privacy requirements of the California Consumer Privacy Act.

The California Consumer Privacy Act of 2018, or CCPA, went into effect on January 1, 2020.

The CCPA imposes expansive data privacy and data protection requirements for the data of California residents, and provides for significant penalties for non-compliance.

The CCPA underwent multiple amendments prior to coming into effect and while enforcement actions may not be brought by the California attorney general until July 1, 2020 it remains unclear how various provisions of the CCPA will be interpreted and enforced.

Further, on November 3, 2020, the California voters passed the California Privacy Rights and Enforcement Act, or CPRA, which replaces the CCPA effective January 1, 2023.

The CPRA alters the scope of covered businesses, adds a new category of sensitive personal information and grants certain consumer rights, such as a right to opt out and a right to delete.

The effects of this legislation potentially are far-reaching, however, and may require us to modify our data processing practices and policies and to incur substantial costs and expenses in an effort to achieve compliance.

The CCPA and the CPRA impose obligations that are new and burdensome, and we may face challenges in addressing their requirements and making necessary changes to our policies and practices and may incur significant expenses in an effort to do so.

Any failure, real or perceived, by us to comply with evolving regulatory requirements, interpretations, or orders, other local, state, federal, or international privacy, data protection, information security, or consumer protection-related laws and regulations, could cause our customers unease and materially and adversely affect our business.

We depend on Louis A.

16 unchanged sentences

We recorded fraud losses of $311,306 and $573,281, respectively, in 2024 and 2023.

We experienced an increase in fraudulent accounts in 2023 as a result of growth in our prepaid card business of 105%.

We experienced a decline in fraudulent accounts in 2024 due to the increasing number of traditional magnetic stripe cards being replaced with cards featuring Europay, MasterCard and Visa chip technology that offer improved security.

Although we actively devote efforts to effectively manage risk and prevent fraud, we could nevertheless experience future increases in fraud losses over our historical experience.

22 unchanged sentences

We utilize a number of systems and procedures to manage and limit credit risks, but if these actions are not successful in managing such risks, we may incur significant losses.

We have adopted certain measures that may make it more difficult for a third party to acquire control of our Company.

Our Board of Director members are classified into three classes of directors serving staggered three-year terms.

Such classification of the Board of Directors expands the time required to change the composition of the majority of directors and may discourage a proxy contest or other takeover bid for our company.

Market conditions could negatively impact our business, results of operations, cash flows and financial condition.

The market in which we operate is affected by a number of factors that are largely beyond our control but can nonetheless have a potentially significant, negative impact on us.

These factors include, among other things:

changes in interest rates and credit spreads;

the availability of credit, including the price, terms, and conditions under which it can be obtained;

slower growth or recession or reduced consumer spending;

the actual and perceived state of the economy and public capital markets generally;

amendments or repeals of legislation, or changes in regulations or regulatory interpretations thereof, and transitions of government, including uncertainty regarding any of the foregoing;

the rise of international conflicts.

Changes in these factors are difficult to predict, and a change in one factor could affect other factors, which could result in adverse effects to our business, results of operations, financial condition, and cash flows.

The broader implications of the macroeconomic environment, including uncertainty around recent international conflicts including the Russia and Ukraine conflict, supply chain shortages, a recession globally or in markets in which we operate, higher inflation rates, higher interest rates, and other related global economic conditions, remain unknown.

A deterioration in macroeconomic conditions could continue to increase the risk of lower consumer spending, merchant and consumer bankruptcy, insolvency, business failure, higher credit losses, or other business interruption, which may adversely impact our business.

If these conditions continue or worsen, they could adversely impact our future financial and operating results.

RISKS RELATED TO OUR INDUSTRY

4 unchanged sentences

Similar to the emergence of the credit card and automatic teller machine industries, we and other organizations serving the electronic commerce market must educate users that electronic transactions use encryption technology and other electronic security measures that make electronic transactions more secure than paper-based transactions.

Changes in regulation of electronic commerce and related financial services industries could increase our costs and limit our business opportunities.

We believe that we are not required to be licensed by the Office of the Comptroller of the Currency, the Federal Reserve Board, or other federal or state agencies that regulate or monitor banks or other types of providers of electronic commerce services.

It is possible that a federal or state agency will attempt to regulate providers of electronic commerce services, which could impede our ability to do business in the regulator's jurisdiction.

Our business has also been affected by anti-terrorism legislation, such as the USA PATRIOT Act.

Banking-related provisions of the USA PATRIOT Act have been implemented as additions to the banking rules regarding monetary instrument sales record keeping requirements and tracking of cash movements.

In our capacity as an agent for Sunrise Banks, N.A., the issuing bank for our prepaid card programs and in our capacity as an agent for Metropolitan Commercial Bank, NABC and TransPecos Bank, the sponsoring banks for our ACH services, we are required to comply with these rules.

We are also required to implement a Customer Identification Program and establish an Anti-Money Laundering program and to report any suspected money laundering to the appropriate agencies.

Our compliance with such regulations increases our responsibilities and costs associated with the administration of our debit card programs.

We are also subject to various laws and regulations relating to commercial transactions, such as the Uniform Commercial Code, and may be subject to the electronic funds transfer rules embodied in Regulation E, promulgated by the Federal Reserve Board.

Given the expansion of the electronic commerce market, the Federal Reserve Board might revise Regulation E or adopt new rules for electronic funds transfer affecting users other than consumers.

Because of growth in the electronic commerce market, Congress has held hearings on whether to regulate providers of services and transactions in the electronic commerce market.

It is possible that Congress or individual states could enact laws regulating the electronic commerce market.

If enacted, such laws, rules and regulations could be imposed on our business and industry and could increase our costs or limit our business opportunities.

If we cannot compete successfully in our industry, we could lose market share and our costs could increase.

7 unchanged sentences

Additionally, competitive pressures may increase our costs, which could lower our earnings, if any.

RISKS RELATED TO REGULATION

Payments and other financial services-related regulations and oversight are material to our business and any failure by us to comply could materially harm our business.

The local, state and federal laws, rules, regulations, licensing schemes and industry standards that govern our business, both directly and through our relationships with banks, card networks and other financial services partners, include, or may in the future include, those relating to payments services, such as payment processing and settlement services, anti-money laundering, combating terrorist financing, escheatment, international sanctions regimes and compliance with the Payment Card Industry Data Security Standard, or PCI-DSS, a set of requirements designed to ensure that all companies that process, store or transmit payment card information maintain a secure environment to protect cardholder data.

We do not directly collect or store payment card information;

instead, we rely on a third-party payment processor to do so.

These laws, rules, regulations, licensing schemes and standards are enforced by multiple authorities and governing bodies in the United States, including the Department of the Treasury, self-regulatory organizations and numerous state and local agencies.

Currently, we do not possess any permits or licenses from financial regulators.

We believe the licensing requirements of federal and state agencies that regulate or monitor banks or other types of providers of electronic commerce services do not apply to us.

While our business itself is not currently subject to financial services-related regulation, and we have received confirmation from multiple state regulators that we are not required to obtain money transmitter licenses in those states, the banks, payment networks and card networks that we partner with operate in a highly regulated landscape and there is a risk that those regulations could become directly applicable to us, such as the Electronic Fund Transfer Act and the Bank Secrecy Act.

Nevertheless, there is a risk that a state regulator may misinterpret our services and find we are offering unlicensed money transmission.

In addition, as our business and products continue to develop and expand, we may become subject to additional laws, rules, regulations, licensing schemes and standards.

In late 2023, the Consumer Financial Protection Bureau, or CFPB, proposed new federal oversight of large technology firms and providers of digital wallets and payment applications that would require large nonbank financial companies handling more than 5 million transactions per year to adhere to the same rules as large banks, credit unions, and other financial institutions already supervised by the CFPB.

The ultimate adoption or impact of this rule is uncertain, but it could materially increase regulatory risks and impact the way we conduct our business.

We may not always be able to accurately predict the scope or applicability of certain laws, rules, regulations, licensing schemes or standards to our business, particularly as we expand into new areas of operations, which could have a significant negative effect on our existing business and our ability to pursue future plans.

In the future, as a result of the regulations that are or may become applicable to our business, we could be subject to investigations and resulting liability, including governmental fines, restrictions on our business or other sanctions, and we could be forced to cease conducting certain aspects of our business with residents of certain jurisdictions, be forced to change our business practices in certain jurisdictions or be required to obtain additional licenses, certifications or regulatory approvals.

There can be no assurance that we will be able to successfully implement changes to our business practices or obtain or maintain any such licenses, certifications or regulatory approvals, and, even if we were able to do so, there could be substantial costs and potential product changes involved in obtaining, maintaining and renewing such licenses, certifications and approvals, which could have a material and adverse effect on our business.

In addition, we could be subject to fines or other enforcement action if we are found to violate disclosure, reporting, anti-money laundering, capitalization, corporate governance or other requirements of such licenses, certifications or approvals.

These factors could impose substantial additional costs, involve considerable delay to the development or provision of our products or services, require significant and costly operational changes or prevent us from providing our products or services in any given market.

As an agent of, and third-party service provider to, our issuing banks, we are subject to indirect regulation and direct audit and examination by the Office of Thrift Supervision, the Office of the Comptroller of the Currency, the Board of Governors of the Federal Reserve System, or FRB, and the Federal Deposit Insurance Corporation.

The Dodd-Frank Wall Street Reform and Consumer Protection Act of 2010, or Dodd-Frank Act, effected and required significant changes to United States financial regulations, include regulations addressing fees charged or received by issuers for processing debit transactions and the transaction routing options available to merchants.

The Dodd-Frank Act also established the Consumer Financial Protection Bureau, or CFPB, to regulate consumer financial services, including many services offered by our customers.

The CFPB is responsible for enforcing and writing rules regarding consumer access to disclosures, fees and statements, error resolution, limited liability and overdrafts when using prepaid cards.

We believe that we are not required to be licensed by the Office of the Comptroller of the Currency, the Federal Reserve Board, or other federal or state agencies that regulate or monitor banks, financial institutions, or other providers of electronic commerce services.

It is possible that a federal or state agency will attempt to expand their regulation of providers of electronic commerce services, which could require us to develop a licensing strategy to do business in the regulator's jurisdiction.

Because of growth in the electronic commerce market, Congress has held hearings on whether to regulate providers of services and transactions in the electronic commerce market.

It is possible that Congress or individual states could enact laws regulating the electronic commerce market.

If enacted, such laws, rules and regulations could be imposed on our business and industry and could increase our costs or limit our business opportunities.

We are subject to U.S.

laws, regulations, rules, standards, policies, contractual obligations and other legal obligations, particularly those related to privacy, data protection and information security, and our actual or perceived failure to comply with such obligations could harm our business.

We store personal and business information, financial information and other sensitive information on our platform.

In addition, we receive, store, handle, transmit, use and otherwise process personal and business information and other data from and about actual and prospective billers and financial institutions, as well as our employees and service providers.

As a result, we are subject to a variety of laws, rules and regulations relating to privacy, data protection and information security, including regulation by various governmental authorities, such as the FTC, and various state, local and foreign agencies.

Our data handling and processing activities are also subject to contractual obligations and industry standard requirements.

The legislative and regulatory landscapes for privacy, data protection and information security continue to evolve in jurisdictions worldwide, with an increasing focus on privacy and data protection issues with the potential to affect our business.

Failure to comply with any of these laws or regulations could result in litigation, enforcement actions, damages, fines, penalties or adverse publicity and reputational damage, any of which could have a material adverse effect on our business, operating results and financial condition.

federal and various state and foreign governments have also adopted or proposed limitations on the collection, distribution, use and storage of data relating to individuals and businesses, including the use of contact information and other data for marketing, advertising and other communications with individuals and businesses.

In the United States, various laws and regulations apply to the security, collection, processing, storage, use, disclosure and other processing of certain types of data, including the Electronic Communications Privacy Act, the Computer Fraud and Abuse Act, the Gramm Leach Bliley Act, and state and local laws relating to privacy and data security.

Additionally, the FTC and many state attorneys general have interpreted and are continuing to interpret federal and state consumer protection laws to impose standards for the online collection, use, dissemination, processing and security of data.

In addition, many states in which we operate have laws that protect the privacy and security of sensitive and personal data and are considering or enacting new laws.

state laws may be more stringent or broader in scope, or offer greater individual rights, with respect to sensitive and personal information than international, federal, or other state laws, and such laws may differ from each other, which may complicate compliance efforts.

For example, California's CCPA, as amended by the CPRA, broadly defines personal information, gives California residents expanded privacy rights and protections, including the right to access and delete certain personal information, as well as the right to opt-out of certain sales of personal information, and provides for civil penalties for violations and a private right of action for data breaches.

This private right of action may increase the likelihood of, and risks associated with, data breach litigation.

California also has a dedicated state agency, the California Privacy Protection Agency, or CPPA, that is vested with authority to implement and enforce the CCPA.

We have taken steps to comply with applicable portions of the CCPA, but we cannot assure you that such steps completely eliminate the risk of liability under the CCPA.

The interpretation and enforcement of the CCPA, as well as other rules promulgated by the CPPA, is in nascent stages, and further regulatory guidance may require us to modify our data collection or processing practices and policies and to incur substantial costs and expenses in an effort to comply and increase our potential exposure to regulatory enforcement and sanctions and litigation.

Certain other state laws besides California's CCPA impose similar privacy obligations, in addition to data breach notification laws in all 50 states.

For example, the CCPA has prompted the enactment of several new state laws or amendments of existing state laws, such as in New York, Nevada, Virginia, Colorado, Connecticut and Utah.

Although CCPA broadly includes business-to-business as well as employee personal information, whereas the other states laws are mostly limited to individual consumers in their household context, these laws mark the beginning of a general trend toward more stringent privacy legislation in other U.S.

states and have prompted a number of proposals for new federal and state-level privacy legislation.

This legislation, if passed or amended, as well as interpretation and implementation of such legislation by state attorneys general or by federal or state regulatory authorities, may add additional complexity, variation in requirements, restrictions and potential legal risk, require additional investment of resources in compliance programs, impact strategies and the availability of previously useful data and could result in increased compliance costs or changes in business practices and policies.

We are subject to the CARD Act which could subject us to civil and criminal liabilities.

The Credit Card Accountability, Responsibility, and Disclosure Act of 2009, or CARD Act imposes requirements relating to disclosures, fees and expiration dates that are generally applicable to gift certificates, store gift cards and general-use prepaid cards.

We believe that our general purpose re-loadable prepaid cards, and the maintenance fees charged on our general purpose re-loadable cards, are exempt from the requirements under this rule, as they fall within an express exclusion for cards which are re-loadable and not marketed or labeled as a gift card or gift certificate.

As a result, we provide retailers with instructions and policies regarding the display and promotion of our general purpose re-loadable cards.

However, it is possible that despite our instructions and policies to the contrary, a retailer engaged in offering our general purpose re-loadable cards to consumers could take an action with respect to one or more of the cards that would cause each similar card to be viewed as being marketed or labeled as a gift card, such as by placing our general purpose re-loadable cards on a display which prominently features the availability of gift cards and does not separate or otherwise distinguish our general purpose re-loadable cards from the gift cards.

In such event, it is possible that such general purpose re-loadable cards would lose their eligibility for such exemption to the CARD Act and its requirements, and therefore we could be deemed to be in violation of the CARD Act and the rule, which could result in the imposition of fines, the suspension of our ability to offer our general purpose re-loadable cards, civil liability, criminal liability, and the inability of our issuing banks to apply certain fees to our general purpose re-loadable cards, each of which would likely have a material adverse impact on our revenues.

We resumed issuing gift cards in 2014.

Any gift cards we issue will be governed by the CARD Act and other various regulations.

Our business is subject to U.S.

federal anti-money laundering, or AML laws and regulations, including the Bank Secrecy Act, or BSA.

AML laws among other things, require certain financial services providers to develop and implement risk-based anti-money laundering programs, report large cash transactions and suspicious activity and maintain transaction records.

We are also subject to certain economic and trade sanctions programs that are administered by the Treasury Department’s Office of Foreign Assets Control, or OFAC, that prohibit or restrict transactions to or from or dealings with specified countries, their governments and, in certain circumstances, their nationals, narcotics traffickers, and terrorists or terrorist organizations.

Similar anti-money laundering, counter terrorist financing and proceeds of crime laws apply to movements of currency and payments through electronic transactions and to dealings with persons specified on lists maintained by organizations similar to OFAC in several other countries and which may impose specific data retention obligations or prohibitions on intermediaries in the payment process.

Provisions of the USA PATRIOT Act, the BSA and other federal law require substantial regulation of financial institutions designed to prevent use of financial services for purposes of money laundering or terrorist financing.

We are also required to implement a Customer Identification Program and establish an Anti-Money Laundering program and to report any suspected money laundering to the appropriate agencies.

Our compliance with such regulations increases our responsibilities and costs associated with the administration of our debit card programs.

In 2011, the Financial Crimes Enforcement Network, or FinCEN, issued its final rule regarding the applicability of the Bank Secrecy Act’s anti-money laundering provisions to prepaid products and other matters related to the regulation of money services businesses.

This rule created additional obligations for entities, including our resellers, engaged in the provision and sale of certain prepaid products, including our prepaid debit cards, such as the obligation for sellers of prepaid debit cards to obtain identification information from the purchaser at the point-of-sale.

Compliance with these obligations could result in increased compliance costs for us, our issuing banks and our resellers.

We are subject to regulations relating to prepaid card programs which could further increase our compliance costs.

Prepaid card programs managed by us are subject to various federal and state laws and regulations, which may include laws and regulations related to consumer and data protection, licensing, consumer disclosures, escheat, anti-money laundering, banking, trade practices and competition and wage and employment.

As regulations evolve, or change, we may be required to obtain state licenses to expand our distribution network for prepaid cards.

Furthermore, the CARD Act and Regulation E impose requirements on general-use prepaid cards, store gift cards and electronic gift certificates.

Prepaid services may also be subject to the rules and regulations of Visa, Mastercard and other payment networks with which we and the card issuers do business.

The programs in place to process these products generally may be modified by the payment networks at their discretion and such modifications could also impact us, financial institutions, merchants and others.

For example, the CFPB issued a final rule in 2016, the Prepaid Account Rule, to regulate certain prepaid accounts.

The Prepaid Account Rule took effect on April 1, 2019, subject to certain exceptions.

Compliance with existing and new obligations as result of further expanding consumer protections regulations like the Prepaid Account Rule, could result in increased compliance costs for us, and our issuing banks and resellers.

The use of Artificial Intelligence could make us subject to evolving regulatory risks

While our use of artificial intelligence, or AI, and machine learning is not material at this time, their use can present risks.

The legal and regulatory landscape surrounding AI technologies is rapidly evolving and uncertain, including in the areas of consumer protection, intellectual property, cybersecurity, and privacy and data protection.

In addition, there is uncertainty around the validity and enforceability of intellectual property rights related to the use, development, and deployment of AI-generated outputs.

Compliance with new and emerging laws, regulations or industry standards relating to AI in the U.S., such as the SEC, FTC, and U.S.

state regulations, may impose significant operational costs and may limit our ability to develop, deploy or use existing or future AI technologies.

As a result, our ability to adapt our existing products and services or develop future and new products and services using AI may be limited or restricted, which could adversely impact our business.

RISKS RELATED TO OUR COMMON STOCK

15 unchanged sentences

There are 5,000,000 shares of Common Stock reserved for issuance under the 2015 Plan.

Additionally, the number of shares of our Common Stock reserved for issuance under our 2015 Plan automatically increases on January 1 of each year, beginning on January 1, 2022, and continuing through and including January 1, 2031, by 5% of the total number of shares of our capital stock outstanding on December 31 of the preceding calendar year (determined on an as-converted to voting common stock basis, without regard to any limitations on the conversion of the non-voting common stock), or a lesser number of shares determined by our board of directors.

As of December 31, 2023, we had granted awards under the 2015 Plan for 7,889,455 shares of Common Stock and have 5,510,845 shares still reserved.

Additionally, the number of shares of our Common Stock reserved for issuance under our 2015 Plan automatically increases on January 1 of each year, beginning on January 1, 2016, and continuing through and including July 2, 2025, by 5% of the total number of shares of our capital stock outstanding on December 31 of the preceding calendar year (determined on an as-converted to voting common stock basis, without regard to any limitations on the conversion of the non-voting common stock), or a lesser number of shares determined by our board of directors.

In addition, pursuant to our 2023 Employee Stock Purchase Plan (“ESPP”), we have reserved 2,500,000 shares of Common Stock.

1 unchanged sentence

and (ii) such number of shares of Common Stock that would cause the aggregate number of shares of Common Stock then reserved for issuance under the ESPP to not exceed 2,500,000 shares.

As of December 31, 2023, no shares of our Common Stock had been purchased pursuant to the ESPP.

As of December 31, 2024, 66,959 of our Common Stock had been purchased pursuant to the ESPP.

Unless our board of directors elects not to increase the number of shares available for future grant pursuant to our 2015 Plan and ESPP each year, our stockholders may experience additional dilution, which could cause our stock price to fall.

27 unchanged sentences

These stockholders have the ability to substantially control our operations and direct our policies including the outcome of matters submitted to our stockholders for approval, such as the election of directors and any acquisition or merger, consolidation or sale of all or substantially all of our assets.

GENERAL RISK FACTORS

Market conditions could negatively impact our business, results of operations, cash flows and financial condition.

The market in which we operate is affected by a number of factors that are largely beyond our control but can nonetheless have a potentially significant, negative impact on us.

These factors include, among other things:

changes in interest rates and credit spreads;

the availability of credit, including the price, terms, and conditions under which it can be obtained;

slower growth or recession or reduced consumer spending;

the actual and perceived state of the economy and public capital markets generally;

amendments or repeals of legislation, or changes in regulations or regulatory interpretations thereof, and transitions of government, including uncertainty regarding any of the foregoing;

the rise of international conflicts.

If these conditions continue or worsen, they could adversely impact our future financial and operating results.

We have adopted certain measures that may make it more difficult for a third party to acquire control of our Company.

Our Board of Director members are classified into three classes of directors serving staggered three-year terms.

These provisions in our bylaws could make it more difficult for a third party to acquire us without the approval of our board.

In addition, the Nevada corporate statute also contains certain provisions that could make an acquisition by a third party more difficult.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1A. Risk Factors